[MFSA-2016-88] Security vulnerabilities fixed in Thunderbird 45.4

Severity Critical

Affected Packages 1

Fixed Packages 1

CVEs 11

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

CVE-2016-5250: Resource Timing API is storing resources sent by the previous page (moderate) URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure.
CVE-2016-5257: Memory safety bugs fixed in Thunderbird 45.4 (critical) Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Thunderbird ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString (high) An out-of-bounds write of a boolean value during text conversion with some unicode characters.
CVE-2016-5272: Bad cast in nsImageGeometryMixin (high) A bad cast when processing layout with <code>input</code> elements can result in a potentially exploitable crash.
CVE-2016-5274: use-after-free in nsFrameManager::CaptureFrameState (high) A use-after-free issue in web animations during restyling.
CVE-2016-5276: Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList (high) A use-after-free vulnerability triggered by setting a <code>aria-owns</code> attribute
CVE-2016-5277: Heap-use-after-free in nsRefreshDriver::Tick (high) A use-after-free vulnerability with web animations when destroying a timeline
CVE-2016-5278: Heap-buffer-overflow in nsBMPEncoder::AddImageFrame (critical) A potentially exploitable crash caused by a buffer overflow while encoding image frames to images
CVE-2016-5280: Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap (high) Use-after-free vulnerability when changing text direction
CVE-2016-5281: use-after-free in DOMSVGLength (high) Use-after-free vulnerability when manipulating SVG format content through script
CVE-2016-5284: Add-on update site certificate pin expiration (high) Due to <a href="https://blog.mozilla.org/security/2016/09/16/update-on-add-on-pinning-vulnerability/">flaws in the process we used to update "Preloaded Public Key Pinning"</a> in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected.

Package	Affected Version
pkg:mozilla/Thunderbird	< 45.4

Package	Fixed Version
pkg:mozilla/Thunderbird	= 45.4

ID

MFSA-2016-88

Severity

critical

URL

https://www.mozilla.org/en-US/security/advisories/mfsa2016-88

Published

2016-10-03T00:00:00
(8 years ago)

Modified

2016-10-03T00:00:00
(8 years ago)

Other Advisories

Source	# ID	Name	URL
Bugzilla	1254688	1254688	https://bugzilla.mozilla.org/show_bug.cgi?id=1254688
Bugzilla	1288588	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1288588
Bugzilla	1287204	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1287204
Bugzilla	1294407	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1294407
Bugzilla	1293347	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1293347
Bugzilla	1288780	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1288780
Bugzilla	1288555	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1288555
Bugzilla	1289280	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1289280
Bugzilla	1294095	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1294095
Bugzilla	1277213	Memory safety bugs fixed in Thunderbird 45.4	https://bugzilla.mozilla.org/show_bug.cgi?id=1277213
Bugzilla	1291016	1291016	https://bugzilla.mozilla.org/show_bug.cgi?id=1291016
Bugzilla	1297934	1297934	https://bugzilla.mozilla.org/show_bug.cgi?id=1297934
Bugzilla	1282076	1282076	https://bugzilla.mozilla.org/show_bug.cgi?id=1282076
Bugzilla	1287721	1287721	https://bugzilla.mozilla.org/show_bug.cgi?id=1287721
Bugzilla	1291665	1291665	https://bugzilla.mozilla.org/show_bug.cgi?id=1291665
Bugzilla	1294677	1294677	https://bugzilla.mozilla.org/show_bug.cgi?id=1294677
Bugzilla	1289970	1289970	https://bugzilla.mozilla.org/show_bug.cgi?id=1289970
Bugzilla	1284690	1284690	https://bugzilla.mozilla.org/show_bug.cgi?id=1284690
Bugzilla	1303127	1303127	https://bugzilla.mozilla.org/show_bug.cgi?id=1303127

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:mozilla/Thunderbird		Thunderbird	< 45.4
Fixed	pkg:mozilla/Thunderbird		Thunderbird	= 45.4

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date